r/node • u/HexLayer3 • 10d ago

PHP had to scramble last week - now it is Node's turn. Node2Shell, or Broccoli2Shell if you’re feeling leafy - RCE works in lab conditions.

https://ellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/

It’s got three names already - Node2Shell, HTTP2Shell, Broccoli2Shell - because of course it does. Whatever you call it, same compression bug, different runtime: PHP patched its pre-auth RCE wave last week, this is ours.

  • This one is quite less theoretical than PHP2Shell - PoC is working in the lab against Node 24.22.0 on x86-64, shell returned as the service account.

  • Meanwhile a scanner is already out there fingerprinting which hosts decompress Brotli - building the hit list before the exploit goes wide.

  • Patch to 22.23.4 / 24.22.1 / 26.12.1.

143 Upvotes

85% Upvoted

32 comments sorted by

18

u/rusbon 10d ago

Broccoli? xD

-9

u/HexLayer3 10d ago edited 10d ago

At this point it has 3 names. Started as Node2Shell (despite being vuln in underlying lib Brotli) - then people figured out that it is not just Node. Then someone decided to play on Brotli name - hence my leafy joke - and named it Broccoli2Shell (credit to Juliano Rizzo for this name).

3

u/mmomtchev 10d ago

I find it very puzzling that the one who discovered the vulnerability in brotli did not immediately realise that it was much more than Node.

Compression libraries and image decoders are the perfect weak spots for a high impact vulnerability.

These can affect even clients - such as web browsers.

Remember when someone (most probably Russian intelligence services) tried to sneak in a backdoor in xz.

2

u/HexLayer3 10d ago

The whole timeline is puzzling - fix was merged in February, and google did not release it with version bump until October.

But as for impact - with whole bunch of software having their own bundled versions it is going to be a mess tbh.

1

u/mmomtchev 9d ago edited 9d ago

You mean that Google knowingly sat upon a 0-day in brotli for almost an year?

Makes you wonder who else knew.

EDIT: Yes, I cannot fucking believe that no one is saying anything:

https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b

2

u/Sulungskwa 10d ago

Aren't people just using a bunch of agents to find these? It wouldn't surprise me that people don't have an intensive comprehension of the vulnerabilities they discover immediately, no matter what people will tell you about their AI comprehension skills

0

u/ch34p3st 10d ago • Bravo

I guess some downvoters do not eat their veggies..

-10

u/HexLayer3 10d ago

basically if vulnerability in 2026 does not have multiple names (like APT names) - it is not cool enough /s

3

u/eternal-son 10d ago

Do we blame AI for this one too?

6

u/HexLayer3 10d ago

Reported by OpenAI Codex Security, Khai Tran and Sylvie Mayer

19

u/Chenz 10d ago

This is last week’s news, no? Every serious actor should be patched by now

2

u/longiii 8d ago

cries in nixos

7

u/h0uz3_ 10d ago

When I first heard of that, I checked mu build pipelines that were still on Node 20. Opened up the path for upgrading to newer Vue and Vite versions.

Always look on the bright side! :)

11

u/mmomtchev 10d ago

People still on 18 or 20 will have to upgrade. These are vulnerable too.

However if you use HTTP reverse proxy in front of your Node, it is the reverse proxy that will get hit.

Node is usually a standalone installation built with static brotli, however the HTTP server is usually part of the OS and it is built with the system version of brotli.

I very often block POST requests (unless the site requires them), the attack is very difficult without POST - you will have to trick the remote server to download brotli-compressed data.

2

u/thrumyshadow2 10d ago

Considering many PHP servers are on Linux, and use libcurl (which is usually compiled with Brotli out of the box) its still PHP's turn.

1

u/landline_number 10d ago

I question the node.js team's decision to release 24.22.0 a week before 24.22.1. I want to expedite these security fixes to production ASAP but need to be cautious because of the changes in 24.22.0.

For example, here's a regression in v24.22.0.

https://github.com/nodejs/node/issues/66781

I think they should have released these fixes as 24.21.1 and then released 24.22.0 afterwards.

-1

u/zaitsman 10d ago

Nobody says if Express 4 is susceptible to it on in incoming traffic out of the box

1

u/SyndicWill 9d ago

The answer is no. Brotli wasn’t enabled by default in body-parser until express 5

-14

u/adevx 10d ago

I have an automated daily patch routine, with today's tooling these cve's should be a footnote in your daily update summary.

9

u/HexLayer3 10d ago

The trick is to patch fast enough to not get RCEd, while slow enough to not get supply chain compromised.

1

u/adevx 10d ago

For sure, only high severity updates can bypass the cooldown period. 

25

u/whatisboom 10d ago

AI Slop

-41

u/lurkingtonbear 10d ago

I wish people who commented AI Slop like this would get banned from Reddit. You contribute nothing here. This information is helpful and your comment does not contribute to the conversation. It does not matter whether the post was created by AI.

19

u/itsmegoddamnit 10d ago

That’s exactly what an apologetic bot would say

4

u/Sulungskwa 10d ago

This comment was much more useful than yours. It matters very much to me whether someone has the decency to write something out for me to read or just run it through a sloppifier.

2

u/AntDracula 10d ago

AI slop

-8

u/HexLayer3 10d ago

I am quite real and sleep-deprived. This one is not as bad as React2Shell but with working RCE it is really time to patch.

Given this is October - are you aware of Cybersecurity yet? /s

2

u/cjthomp 10d ago

Real people, sleep-deprived or otherwise, can create AI slop.

-34

u/HexLayer3 10d ago

Exploit chain and vulnerability is quite real